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Quantum continuous variables Q are being explored HIllllllllllllSEIillillillil 

as an alternative means to implement quantum key distribution, which is usually based on single 
photon counting fisll . The former approach is potentially advantageous because it should enable 
higher key distribution rates. Here we propose and experimentally demonstrate a quantum key 
distribution protocol based on the transmission of gaussian-modulated coherent states (consisting of 
laser pulses containing a few hundred photons) and shot-noise-limited homodyne detection; squeezed 
or entangled beams are not required [l^. Complete secret key extraction is achieved using a reverse 
reconciliation IT^ technique followed by privacy amplification. The reverse reconciliation technique 
is in principle secure for any value of the line transmission, against gaussian individual attacks based 
on entanglement and quantum memories. Our table-top experiment yields a net key transmission 
rate of about 1.7 megabits per second for a loss-free line, and 75 kilobits per second for a line with 
losses of 3.1 dB. We anticipate that the scheme should remain effective for lines with higher losses, 
particularly because the present limitations are essentially technical, so that significant margin for 
improvement is available on both the hardware and software. 



Much interest has arisen recently in using the elec- 
\ tromagnetic field amplitudes to obtain possibly more 
efficient quantum continuous variable (_QCV) alterna- 
tives 

sussiiissiiaiiiEiiiiiii to 

the usual photon-counting quan turn key distribution 
(QKD) techniques (see ref. and references therein) 
— for instance, by usin g " non-classical" light beams 
■ 11 lljl H II II H S ES 113 In fact, it was shown in 
\ ref. that squeezed or entangled light is not required 
to achieve this goal: an equivalent level of security may 
be obtained by transmitting "quasi-classical" coherent 
states. When the line transmission is larger than 50 % 
(line loss < 3 dB), the physical limits on QCV cloning 
[TgL IT^ lisl ensure that this protocol is secure against 
individual attacks. This corroborates the fact that QKD 
only requires non-orthogonal states, and may well work 
with macroscopic signals instead of single photons [T^ . 
There are in principle various way s for the partners Alice 
and Bob to distribute keys beyond this 3 dB limit, for 
instance by using entanglement purification '20] or post- 
selection 12]. Therefore these QCV schemes stimulate 
many fundamental questions about the physical origin of 
QKD security. As will be shown below, cryptographic 
security appears to have a strong relationship with en- 
tanglement, even though our protocol does not rely on 
entangled states. 

Here we introduce and implement a coherent-state 
QKD protocol, and we demonstrate that it is, in prin- 
ciple, secure for any value of the line transmission. It 
relies on the distribution of a gaussian key obtained 
by continuously modulating the phase and amplitude of 



'Published in Nature (London) 421, 238-241 (16 January 2003). 



coherent light pulses |13| at Alice's side, and subsequently 
performing homodyne detection at Bob's side. The con- 
tinuous data are then converted into a common binary 
key via a specifically designed reconciliation algorithm 
1^ ^3- The security against arbitrarily high losses is 
achieved by reversing the reconciliation protocol, that is, 
Alice attempts to guess what was received by Bob rather 
than Bob guessing what was sent by Alice. Such a reverse 
reconciliation protocol 0| gives Alice an advantage over 
a potential eavesdropper Eve, regardless of the line loss. 
The practical limitations of our scheme are essentially 
technical, and appear to be due mostly to the limited 
efficiency of the reconciliation software. 

The protocol runs as follows First, Alice draws 

two random numbers xa and pA from a gaussian dis- 
tribution of mean zero and variance VaNq, where iVg 
denotes the shot-noise variance. Then, she sends the co- 
herent state \xA + ipA) to Bob, who randomly chooses 
to measure either quadrature x or p. Later, using a pub- 
lic authenticated channel, he informs Alice about which 
quadrature he measured, so she may discard the irrele- 
vant data. After many similar exchanges, Alice and Bob 
(and possibly the eavesdropper Eve) share a set of corre- 
lated gaussian variables, which we call "key elements". 

Classical data processing is then necessary for Alice 
and Bob to obtain a fully secret binary key. First, Al- 
ice and Bob publicly compare a random sample of their 
key elements to evaluate the error rate and transmission 
efficiency of the quantum channel. From the observed 
correlations, Alice and Bob evaluate the amount of infor- 
mation they share {Iab ~ Iba) and the maximum infor- 
mation Eve may have obtained (by eavesdropping) about 
their values {Iae and I be)- It is known that Alice and 
Bob can, in principle, distil from their data a common se- 
cret key of size S > sup (/as — Iae, Iba ~ Ibe) bits per 
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key element [2l|, |22| ■ This requires classical communica- 
tion over an authenticated public channel, and may be 
divided into two steps : reconciliation (that is, correcting 
the errors while minimizing the information revealed to 
Eve) and privacy amplification (that is, making the key 
secret). As we deal here with continuous data, we devel- 
oped a "sliced" reconciliation algorithm 'sl, to extract 
common bit strings from the correlated key elements. In 
order to reconcile Bob's measured data with Alice's sent 
data, the most natural way to proceed is that Bob gets 
R extra bits of information from Alice in order to cor- 
rect the transmission errors. The corresponding direct 
reconciliation (DR) protocols, which have been used so 
far in QCV QKD |3, ^| , allow the generation of a com- 
mon string of Iab + R bits, of which Eve may know up 
to Iae + R bits. Here we rather consider reverse recon- 
ciliation (RR) protocols where Bob sends R bits of 
information to Alice so that she incorporates the trans- 
mission errors in her initial data. These RR protocols 
allow the generation of a common string of Iba + R bits, 
of which Eve may know Ibe-'tR bits. This turns out to be 
particularly well suited to QCV QKD, because it is more 
difficult for Eve to control the errors at Bob's side than 
to read Alice's modulation. The last step of key extrac- 
tion, namely privacy amplification, consists of filtering 
out Eve's information by properly mixing the reconciled 
bits to spread Eve's uncertainty over the entire final key. 
This procedure requires an estimate of Eve's information 
on the reconciled key, so we need a bound on Iae for 
DR, or I BE for RR- In addition, Alice and Bob must 
keep track of the information publicly revealed during 
reconciliation. This knowledge is destroyed at the end 
of the privacy amplification procedure, reducing the key 
length by the same amount. The DR bound 'l3j on Iae 
implies that the security cannot be warranted if the line 
transmission G is below 50%. We will now establish the 
RR boimd on IBE^ and show that it is not associated 
with a minimum value of G. 

In a RR scheme, Eve needs to guess Bob's measure- 
ment outcome without adding too much noise on his 
data. This can be done via an "entangling doner" , which 
creates two quantum-correlated copies of Alice's quan- 
tum state, so Eve simply keeps one of them while sending 
the other to Bob. Let (a;in,Pin) be the input field quadra- 
tures of the entangling doner, and {xb,Pb)i {xe,Pe) the 
quadratures of Bob's and Eve's output fields. To be safe, 
we must assume Eve uses the best possible entangling 
doner compatible with the parameters of the Alice-Bob 
channel: Eve's doner should minimize the conditional 
variances |U 13 Vi^B\xE) and V{pb\pe), that is, the 
variances of Eve's estimates of Bob's field quadratures 
{xb ,Pb)- These variances are constrained by Heisenberg- 
type relations (see Appendix^, which limit what can be 
obtained by Eve: 

VixB\xA)V{pB\pE) >iVo 

VipB\pA)V{xB\xE)>N^ (1) 

where V{xb\xa) and V{pb\pa) denote Alice's condi- 



tional variances. This means that Alice and Eve can- 
not jointly know more about Bob's conjugate quadra- 
tures than is allowed by the uncertainty principle. Now, 
Alice's variances can be bounded by using the measured 
parameters of the quantum channel, which in turn makes 
it possible to bound Eve's variances. 

The channel is described by the linear relations Xb = 
Gl^^{xin + Bx) and pB = G^^ipin + Bp), with {xfj = 
{pD = VNo > No, {BlJ = x.^pNo, and {x^ = 
{pinBp) — 0. Here Xx, Xp represent the channel noises re- 
ferred to its input, called equivalent input noises 23>, 2^, 
while Gx, Gp are the channel gains in x and p, and 
V is the variance of Alice's field quadratures in shot- 
noise units (V = Va + 1). The output-output correla- 
tions of the entangling doner, described by V{xb\xe) 
and V{pb\pe), depend only on the density matrix Di^ 
of the input field (xin,Pin), and not on the way it is pro- 
duced, namely whether it is a gaussian mixture of coher- 
ent states or one of two entangled beams. Inequalities ^ 
thus have to be fulfilled for all physically allowed values 
of V{xb\xa) and V{pb\pa), given Dia- Therefore, the 
values oiV{xB\xA) and V{pb\pa) that should be used in 
inequalities ^ to limit Eve's knowledge are the minimum 
values Alice might achieve by using the maximal entan- 
glement compatible with V, namely (see Appendix IX)) 

VixB\xAUin = G^iXx + V-^)No 
V{pB\pA)unn = GpiXp + ■^"')A^0 (2) 

These lower bounds are thus directly connected with en- 
tanglement, even though Alice does not use it in prac- 
tice. They may be compared with the actual values 
when Ahce sends coherent states, that is, V{xb\xa)co\i — 
G^iXx + l)No and V{pB\pA)coh = Gp{xp + l)No. The 
lower bounds on Eve's conditional variances are then ob- 
tained from equations and as: 

V{pb\pe) > No/{G.Axx + V-')} 

VixB\xE) > No/{Gp{xp + V-^)} (3) 

A physical realization of an entangling doner reaching 
these bounds is sketched in ref. . 

To assess the security of the RR scheme, one assumes 
that Eve's ability to infer Bob's measurement can reach 
the limit put by inequalities Q. For simplicity, we con- 
sider the channel gains and noises and the signal vari- 
ances to be the same for x and p (in practice, deviations 
should be estimated by statistical tests). The informa- 
tion rates can be derived using Shannon's theory for gaus- 
sian additive-noise channels [2a|, giving 

Iba = (l/2)fog2[^B/(VBM) 

cohj 

= (l/2)log2[(V + x)/(l + x)] (4a) 

IbE = {l/2)l0g^[VB/{VBlE)nun] 

= {l/2)log^[G^iV + x){V-'+x)] (4b) 

expressed in bits per symbol (or per key element). Here 

Vb = {xD = {p%) = GiV + x)No is Bob's vari- 
ance, (yB|£;)min = V{xB\xE)mhi = V{pB\pE)min = 
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FIG. 1: Experimental set-up. Laser diode, SDL 5412 
(780 nm); 01, optical isolator; A/2, half- wave plate; 
AOM, acousto-optic modulator; MF, polarization maintain- 
ing single-mode fibre; OA, optical attenuator; EOM, electro- 
optic amplitude modulator; PBS, polarizer; BS, beam split- 
ter; PZT, piezoelectric transducer. Focal lengths (/') are 
given in millimetres. R and T are reflection and transmis- 
sion coefficients. 



N[)/{G{x + ^ ^)} is Eve's minimum conditional vari- 
ance, and (VB|A)coh = V{xB\xA)coh = V{pb\pa)co\i = 
G{x + l)./Vo is Alice's conditional variance for a coherent- 
state protocol. The secret bit rate of a RR protocol is 
thus 

^Irr — Iba — Ibe 

= ~il/2)log,[G'il + x){V-'+x)] (5) 

and the security is guaranteed if A/^j^ > 0. The equiva- 
lent input noise x can be split into a "vacuum noise" com- 
ponent due to the Hne losses, given by Xvac = {l~G)/G, 
and an "excess noise" component defined as e = x — Xvac • 
In the high- loss limit (G 1), the RR protocol remains 
secure if e < {V — 1)/{2V) ~ 1/2, that is, if the amount of 
excess noise e is not too large. In contrast, a DR protocol 
requires low-loss lines, as the security is warranted only 
if X < 1, that is, if G > l/(2-e). Note that DR tolerates 
an excess noise up to e « 1, so it might be preferred to 
RR for low-loss but noisy channels. 

Our experimental implementation (Fig.^ of the quan- 
tum key exchange uses 120-ns coherent pulses at a 800- 
kHz repetition rate (wavelength of 780 nm, see Ap- 
pendix^. Data bursts of 60,000 pulses have been anal- 
ysed (Fig. 121). For each burst, a subset of the values are 
disclosed to evaluate the transmission G and the total 
added noise variance. The output noise has four contri- 
butions: the shot noise Nq, the channel noise xunc^o, 
the electronics noise of Bob's detector (A'^ei = 0.33iVo), 
and the noise due to imperfect homodyne detection effi- 
ciency (iVhom = 0.27A'o). When introducing line losses 
using a variable attenuator, the measured xiinc increases 
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FIG. 2: Bob's measured quadrature as a function of the am- 
plitude sent by Alice (in Bob's measurement basis) for a burst 
of 60,000 pulses. The line transmission is 100% and the mod- 
ulation variance is V = 41.7. The solid line represents the 
expected unity slope. Inset, the corresponding histograms of 
Alice's (grey curve) and Bob's (black curve) data. 
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FIG. 3: Channel equivalent noise xiine as a function of line 
transmission G. The curve is the theoretical prediction Xvac = 
(1 — G)/G. The errors bars include two contributions with 
approximately the same size, from statistics (evaluated over 
blocks of 60,000 pulses) and systematics (calibration errors 
and drifts). 



as (1 — G)/G, as shown in Fig.|31(eiinc — here). The two 
detection noises A'^ei and iVhom originate from Bob's de- 
tection system, so they must be taken into account when 
estimating Iba- In contrast, we may reasonably assume 
that Eve cannot know or control the corresponding fluc- 
tuations, so her attack is inferred on the basis of the 
line noise xiino only (see Appendix^ for details). Fig- 
ure ^ shows explicitly the mutual information between 
all parties, which makes straightforward the comparison 
between the DR and RR protocols. 

We wrote a computer program that implements the 
reconciliation algorithm followed by privacy amplification 
(see Appendices 1X1 and IB|) . Although Alice and Bob are 
not spatially separated in the present set-up, the anal- 
ysed data have the same structure as in a realistic cryp- 
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TABLE L Ideal and practical net secret key rates. The parameters of the quantum key exchange are measured for several 
values of the channel transmission G (the corresponding losses are also given in decibels). The variations of the variance 
V of Alice's field quadrature are due to different experimental adjustments. The information Iba is given in bits per time 
slot. Also shown are the maximum information gained by Eve {I be) and the extracted information by reverse reconciliation 
(Jrcc). The ideal secret key bit rates would be obtained from our measured data with perfect key distillation that yields exactly 
Iba — Ibe bits (RR) or Iab — Iae bits (DR), whereas the practical secret key bit rates are the one achieved with our current 
key distillation procedure ("-" means that no secret key is generated). Both bit rates are calculated over bursts of about 60,000 
pulses at 800 kHz, not taking into account the duty cycle (~ 5%) in the present set-up. 
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FIG. 4: Values of Iba, Ibe, and Iae as a function of the 
line transmission G for V ~ 40. Here, Iba is given by 
equation Mai , including all transmission and detection noises 
for evaluating Vb and (VB|A)coh- The expression for Ibe is 
given by equation MbL using the same Vb and {VB\E)min = 

No/{GixUne + V-^)} + iVel + iVhom- This expression realisti- 
cally assumes that Eve cannot know the noises A^ci and A^hom, 
which are internal to Bob's detection set-up. For comparison 
with DR, the value of Iae is also plotted (the theoretical value 
of Iae is obtained from ref. [T^'). 



tographic exchange. TableClshows the ideal and practical 
net key rates of our reverse QKD protocol, as well as the 
DR values for comparison. The RR scheme is efficient for 
any value of G provided that the reconciliation protocol 
achieves the limit given by Iba- However, unavoidable 
deviations of the algorithm from Shannon's limit reduce 
the actual reconciled information /roc between Alice and 
Bob, while Ibe is of course assumed unaffected. For high 
modulation (V « 40) and low losses, the reconciliation 
efficiency lies around 80%, which makes it possible to dis- 
tribute a secret key at a rate of several hundreds of kilo- 
bits per second. However, the achievable reconciliation 



efficiency drops when the signal-to-noise ratio decreases, 
but this can be improved by reducing the modulation 
variance, which increases the ratio Iba/ Ibe- Although 
the ideal secret key rate is then lower, we could pro- 
cess the data with a reconciliation efficiency of 78% for 
G = 0.49 (3.1 dB) and V = 27, resulting in a net key 
rate of 75 kbits s~^ (see also Appendix 0. This clearly 
demonstrates that RR continuous-variable protocols op- 
erate efficiently at and beyond the 3 dB loss limit of DR 
protocols. We emphasize that this result is obtained de- 
spite the fact that the evaluated reconciliation cost is 
higher for RR than for DR: the better result for RR is 
essentially due to its initial "quantum advantage" . 

In photon-counting QKD, the key rate is limited by 
the single-photon detectors, in which the avalanche pro- 
cesses are difficult to control reliably at very high count- 
ing rates. In contrast, homodyne detection may run at 
frequencies up to tens of MHz. In addition, a specific 
advantage of the high dimensionality of the QCV phase 
space is that the field quadratures can be modulated with 
a large dynamics, allowing the encoding of several key 
bits per pulse (see Table QJ. Very high secret bit rates 
are therefore attainable with our coherent-state protocol 
on low-loss lines. For high-loss lines, our protocol is at 
present limited by the reconciliation efficiency, but its in- 
trinsic performances remain very high. Since most of the 
limitations of the present proof-of-principle experiment 
appear to be of a technical nature, there is still a con- 
siderable margin for improvement, both in the hardware 
(increased detection bandwidth, better homodyne effi- 
ciency, lower electronic noise), and in the software (better 
reconciliation algorithms 26] , see Appendix . In con- 
clusion, the way seems open for implementing the present 
proposal at telecommunications wavelengths as a practi- 
cal, high bit-rate, quantum key distribution scheme over 
long distances. 

Acknowledgements. The contributions of J. Gao to 
early stages of the experiment, and of K. Nguyen to the 
software development, are acknowledged. We thank S. 
Iblisdir for discussions, and Th. Debuisschert for the loan 



5 



of the 780 nm integrated modulator. This work was sup- 
ported by the EU programme IST/FET/QIPC (projects 
"QUICOV" and "EQUIP"), the French programmes ACI 
Photoniquc and ASTRE, and by the Belgian programme 
ARC. 

Correspondence and requests for materials 
should be addressed to Philippe Grangier (e-mail 
philippe . grangierSiota.u-psud.fr). 

APPENDIX A: METHODS 

Relevant Heisenberg relations 

In a RR protocol, Alice's estimator for xb and Eve's 
estimator for pg can be denoted respectively as axA 
and (3pE, where a, f3 are real numbers. The corre- 
sponding errors are XB\A.a — xb — axA, and Pb\e,p = 
Pb — fipE- Because Alice's, Bob's, and Eve's oper- 
ators commute, we have [xB\A,aTPB\E,f3\ = [^BtPb], 
and thus the Heisenberg relation Ax^i^ ^Ap^|^ ^ > 

Nq. Defining the conditional variances as V{xb\xa) — 
mina{Aa;^l^^^} and V{pb\pe) = min/3{Ap||^_^}, we 
obtain V{xb\xa)V(jpb\pe) > A"q, or, by exchanging x 
and p, V{pb\pa)V{xb\xe) > N^- 

Alice has the estimators {xa,Pa) for the field 
(a^iinPin) — {xA + Ax, PA + Ap) that she sends, with 
(A^) = (Ap) — sNq. Here s measures the amount of 
squeezing possibly used by Alice in her state preparation 
[lj|, with s > for consistency with Heisenberg's 

relations. By calculating {p\) — (V — s)No, {p\) — 

Gp{y + Xp)^o, {paPb) = gI^^{p\), we obtain the con- 
ditional variance V{pb\pa) = {p%) - \{paPb)? I {Pa) = 
Gp{s -l- Xp)A^o- This equation and the constraint s > 
gives V{pb\pa) > Gp{V~^ + Xp)No, and similarly 
V{xb\xa) > Gx{V-^ + Xx)No. The bound on Vb\a is 
thus obtained by assuming that Alice may use squeezed 
or entangled beams, while the bound on Vb\e can only be 
achieved if Eve uses an entangling attack. This reflects 
the fact that squeezing or entanglement play a crucial role 
in our security demonstration, even though the proto- 
col implies coherent states. Our security proof addresses 
individual gaussian attacks only, but as the entangling 
doner attack saturates the Heisenberg uncertainty rela- 
tions, we conjecture that it encompasses all incoherent 
(non-collective) eavesdropping strategies. 

Experimental set-up 

A continuous-wave laser diode at 780 nm wavelength 
associated with an acousto-optic modulator is used to 
emit 120-ns (full-width at half-maximum) pulses at a 
800 kHz rate. The signal pulses contain up to 250 
photons, while the local oscillator (LO) power is 1.3 x 
10^ photons per pulse. The amplitude of each pulse 
is arbitrarily modulated by an integrated electro-optic 



modulator. However, owing to the unavailability of a 
fast phase modulator at 780 nm, the phase is not ran- 
domly modulated but scanned continuously. No genuine 
secret key can be distributed, strictly speaking, but ran- 
dom permutations of Bob's data are used to provide re- 
alistic data (see Appendix . The data are organized 
in bursts of 60,000 pulses, separated by synchronization 
periods also used to lock the phase of the LO. The overall 
homodyne detection efficiency is 0.81, due to the optical 
transmission (0.92), the mode-matching efficiency (0.96) 
and the photodiode quantum efficiency (0.92). For the 
critical data at 3 dB loss, the mode-matching efficiency 
was improved to 0.99, and thus the overall efficiency was 
0.84. We also point out that many blocks of data were 
exchanged around the 3 dB loss point, with a typical rate 
above 55 kbit s~^. 



Secret key distillation 

A common bit string is extracted from the continuous 
data by sequentially reconciling several strings ( "slices" ) 
of binary functions of the gaussian key elements, apply- 
ing a binary reconciliation protocol successively on each 
bit iSjllfll- Here, we used five slices, each being corrected 
either by a trivial one-way protocol (communicating the 
bits) when the bit error rate (BER) is high, or by the two- 
way protocol Cascade (27i,,28j when the BER is low. Note 
that the disclosed slices are useful for reconciling the re- 
maining slices with less information leaking to Eve, even 
though they of course do not yield secret bits as such. In 
addition, Alice and Bob encrypt their classical messages 
using the one-time pad scheme with a fraction of the 
previous key bits, or a bootstrap key for the first block. 
For slices corrected with Cascade, the exchanged pari- 
ties are encrypted with the same key bits on both sides 
|29l | , making Eve aware of the differences between Alice's 
and Bob's parities (that is, the error positions) but not 
of their individual values. Fully communicated slices are 
also encrypted, thereby revealing no information at all to 
Eve. Still, Eve may exploit the interactivity of Cascade 
and gain some information on the final key by combin- 
ing her knowledge of the error positions with that of the 
correlations between Alice's and Bob's gaussian values. 
In the present protocol, this information is numerically 
calculated for an entangling doner attack, and then de- 
stroyed by privacy amplification. This is achieved by 
appropriate "hashing" [30| functions (see Appendix 01. 
The resulting net secret key rate is then obtained by sub- 
tracting, from the raw key rate, the cost of the one-time 
pad encryption and the error-position information. Fi- 
nally, let us emphasize that sliced reconciliation can be 
made very close to a one-way protocol by increasing the 
number of key elements from which the bits are jointly 
extracted (multidimensional reconciliation Q). This ap- 
proach was not implemented here, but should deliver an 
improved secret key rate , ap proaching the value from the 
Csiszar-Korner formula l2U • 
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APPENDIX B: SUPPLEMENTARY 
INFORMATION 

Experimental set-up 

The source consists of a CW laser diode (SDL 5412) at 
780 nm associated with an acousto-optic modulator, used 
to chop pulses with a duration 120 ns (full width at half- 
maximum), at a repetition rate 800 kHz. To reduce the 
excess noise, a grating-extended external cavity is used, 
and the beam is spatially filtered using a single mode 
fiber. Light pulses are then split onto a beam-splitter, 
one beam being the local oscillator (LO), the other Alice's 
signal beam. The data is organised in bursts of 60,000 
pulses, separated by time periods used to lock the phase 
of the LO, and sequences of pulses to synchronize the 
parties. In the present experiment, there is a burst every 
1.6 seconds, corresponding to a duty cycle of about 5%, 
which is obviously under-optimised but should be easy 
to improve in further experiments. 

The coherent state distribution is generated by modu- 
lating both the amplitude and phase of the light pulses 
with the appropriate probability law. In the present ex- 
periment, the amplitude of each pulse is arbitrarily mod- 
ulated at the nominal 800 kHz rate by an integrated 
electro-optic LiNbOS Mach-Zehnder interferometer. In 
contrast, due to the unavailability of a fast phase modu- 
lator at 780 nm, the phase is not randomly modulated but 
scanned continuously from to 2tt using a piezoelectric 
transducer (PZT). For such a deterministic phase varia- 
tion, the security of the protocol is not warranted, and 
thus no genuine secret key could be distributed strictly 
speaking. However, the experiment provides realistic 
data, having exactly the awaited structure provided that 
random phase permutation on Bob's data are performed. 

Due to an imbalance between the paths of the inter- 
ferometer which modulates the amplitude of the signal 
beam, the extinction is not strictly zero. In the present 
experiment that is only aimed at a proof of principle, we 
subtract the offset field from the data received by Bob. In 
a real cryptographic transmission, the offset field should 
be compensated by Alice, either by adding a zeroing field, 
or by using a better modulator. 

All voltages for the electro-optic modulator or the PZT 
are generated by an acquisition board (National Instru- 
ments PCI6111E) connected to a computer. Although 
all discussions assume the modulation to be continuous, 
digitised voltages are used in practice. With our experi- 
mental parameters, a resolution of 8 bits is enough to hide 
the amplitude or phase steps under the shot noise. Since 
the modulation voltage is produced using a 16 bits con- 
verter, and the data is digitised over 12 bits, we may fairly 
assume the modulation and measurement to be continu- 
ous. 

The homodyne detection was checked to be shot-noise 
limited for LO power up to 5 x 10^ photons/pulse. In 
the present experiment, we used 1.3 x 10® photons/pulse 
for LO power, while each signal pulse contains up to 250 



photons. Depending on the run, the overall detection 
efficiency is either 0.81 or 0.84, due to optical transmis- 
sion (0.92), mode-matching visibility (0.96 or 0.99) and 
photodiode quantum efficiency (0.92). 

The experiment is thus carried out in such a way that 
all useful parameters can be measured experimentally. 
Reconciliation and privacy amplification protocols can 
thus be performed in realistic - though not fully secret 
- conditions. The limitations of the present set-up are 
essentially due to the lack of appropriate fast amplitude 
and phase modulators at 780 nm. This should be eas- 
ily solved by operating at telecom wavelengths (1540- 
1580 nm) where such equipment is readily available. Let 
us point out also that it is not convenient to transmit sep- 
arately the signal and LO, so a better solution would be 
to use a frequency sideband technique similar to MeroUa 
et al. [sj. Then all light pulses are transmitted together 
along the same fibre, and a separate radio-frequency is 
sent from Alice to Bob in order to reconstruct the optical 
phase information. 



Hypothesis about the detector's noise : "reahstic" 
vs "paranoid" assumptions 

After the quantum exchange, Alice and Bob reveal a 
subset of their values taken randomly to evaluate the 
transmission G and the total added noise variance. This 
variance has four contributions: the shot noise Nq, the 
channel noise xiincA^Oi the electronics noise of Bob's de- 
tector (iVoi — 0.33iVo), and the noise due to imperfect 
homodyne detection efficiency (A^hom = 0.27A'o). The 
two detection noises Nd and A'hom originate from Bob's 
detection system, so one may reasonably assume that 
they do not contribute to Eve's knowledge. This "re- 
alistic" assumption has been followed in the article. In 
that case, the noise from Bob's detection system also 
affects Eve's information so, in equation (j4b|l . we take 

{Vb |_E')min 

= Afo/{Giinc(xiinc + V'"^)} + A^ci+A^hom, where 
Giino stands for the line transmission. 

In contrast, in a "paranoid" approach, one should as- 
sume that the noises Nc\ and Ahom are also controlled by 
Eve, that gives her a supplementary advantage. In that 
case, (VB|£;)min will be given by No/{G{x+V^^)}, where 
G now includes both the line and detection efficiencies 
and X includes both the line and detection noises. In all 
cases, the value of Iba is given by equation (|4a|l . where x 
is the total equivalent noise including both transmission 
and detection. 

Presently we are able to extract practically a key with 
up to 3.1 dB losses under the "realistic" approach with 
a reverse reconciliation protocol. Considering now the 
"paranoid" assumption and reverse reconciliation, the 
ideal secret key rate is 420 kbits s^^ for a lossless line, 
and 200 kbits s"^ for Gii„e = 0.79 (1.0 dB). However, se- 
cret bits could be delivered only in the lossless case, at a 
practical rate of 195 kbits s~^. It is clear that an increase 
in the reconciliation efficiency would immediately trans- 
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late into a larger achievable range. Let us point out that 
we always assume in both the "realistic" or the "para- 
noid" approach that Eve has an ideal software, quantum 
memories, perfectly entangled beams, etc. If any of these 
hypotheses is relaxed, the practical secure range may be 
extended over the "threshold" presently set by the lim- 
ited reconciliation efficiency. However, it is not the pur- 
pose of the present paper to discuss such "constrained 
attacks" . 



Implementation of secret key distillation 

Secret key distillation was performed by a computer 
program written in standard C-l — h that implements the 
steps described in the paper. Although Alice's and Bob's 
data are both processed on the same computer, it is done 
in the same way as if the parties were distant and were 
using a network connection as classical channel. The par- 
ticular platform used is a regular PC running Linux. 

As bursts of data are input to the program, a part of 
the gaussian key elements are sacrificed and used to es- 
timate the characteristics of the quantum channel. This 
includes the variances and the correlation coefficient be- 
tween both sides, which would be exchanged between Al- 
ice and Bob over the public authenticated classical chan- 
nel in a real-life setup. 

Depending on the value of the estimated Iab, the 
two parties agree on appropriate binary functions (slices 
|kj J^J) that will transform their gaussian values into bits. 
These bits are then reconciled, as described in the paper, 
with sliced error correction [loj | and an implementa- 
tion 28] of Cascade [23| as a sub-routine. In our imple- 
mentation, 5 binary functions are used per gaussian key 
elements, out of which 2 or 3 (depending on Iab) are 
fully disclosed, while the remaining 3 or 2 are reconciled 
using Cascade. 

Next, the data are moved to the privacy amplification 
routine. Excluding the bits that are fully disclosed and 
from which no secret key can be extracted, the reconciled 
bits arc processed by use of a transformation randomly 
taken in a universal class of hash functions [30ll3^ . which 
in our case is the class of truncated linear functions in a 
finite field. First, we consider the reconciled bits as co- 
efficients of a binary polynomial in a representation of 
the Galois field GF(2^^°^°^), hereby called the reconciled 
polynomial. Then Alice and Bob publicly and randomly 
choose a random element of the same field and multi- 



ply the reconciled polynomial with this chosen element. 
Finally, they extract from the resulting polynomial the 
desired number of least significant bits. In our imple- 
mentation, the representation of the field is GF(2)[2:]/ (p), 
where p = x^^'^^'^^ + x^^^ -I- 1 is an irreducible polynomial 
over GF(2), see ref. [3^. The fact that this operation 
can be implemented efficiently l34| motivated our choice. 
The size of the field allows us to process up to 110503 
bits at once, or equivalently blocks of about 55200 gaus- 
sian key elements when Cascade operates on 2 bits per 
gaussian key element or of 36800 elements with 3 bits 
per element. To produce a longer key, the gaussian key 
elements must thus be grouped into blocks. 

As explained in the paper, the number of bits that 
are destroyed by privacy amplification depends on the 
amount of information that could be inferred by a poten- 
tial eavesdropper. An easvesdropper Eve has two sources 
of knowledge. First, she may have attacked the quantum 
channel and second, she knows the error positions of the 
reconciled bits from listening to the execution of Cas- 
cade. Let K be the final key, E the ancilla Eve uses 
for quantum eavesdropping, and A the error positions 
revealed during reconciliation. We thus need to evalu- 
ate IiK;E,A) = I{K;E) + I{K;A\E). The first term 
on the rhs is upper bounded by Ibe (in RR) or Iae (in 
DR), while the second term is evaluated numerically for 
an entangling doner attack. 

This numerical evaluation of I{K;A\E) comes down 
to integrating I{K; A\E = e) for all possible outcomes e 
of E, weighted by the probability density function p(e) of 
E. In the case of the entangling doner attack, E refers 
both to the knowledge of Eve's half of the EPR state 
she injects and to her eavesdropping of the state being 
sent to Bob, so E denotes a bivariate gaussian variable 
whose covariance matrix can be calculated from the chan- 
nel characteristics (i.e., attenuation and added noise am- 
plitude). For a given outcome e of E, Eve can infer A and 
B, Alice's and Bob's key elements as a bivariate gaussian 
variable. Since K and A are discrete functions of only 
A and B, the probability distribution of K{A, B) and 
A{A, B) conditionally on E — e can be calculated, hence 
giving I{K] A\E = e). 

Finally, a part of the generated key is used to encrypt 
[2^ the execution of the reconciliation for the next block. 
The remaining bits, namely the net secret key, can be 
then used for instance to encrypt the classical communi- 
cations between Alice and Bob using a one-time pad. 
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